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Abstract 

A relational database is inconsistent if it does not satisfy a given set of integrity constraints. 
Nevertheless, it is likely that most of the data in it is consistent with the constraints. In 
this paper we apply logic programming based on answer sets to the problem of retrieving 
consistent information from a possibly inconsistent database. Since consistent information 
persists from the original database to every of its minimal repairs, the approach is based 
on a specification of database repairs using disjunctive logic programs with exceptions, 
whose answer set semantics can be represented and computed by systems that implement 
stable model semantics. These programs allow us to declare persistence by defaults and 
repairing changes by exceptions. We concentrate mainly on logic programs for binary 
integrity constraints, among which we find most of the integrity constraints found in 
practice. 



1 Introduction 

Integrity constraints (IC) capture an important normative aspect of every database 
application, whose aim is to guarantee the consistency of its data. However, it is very 
difficult, if not impossible, to always have a consistent database instance. Databases 
may become inconsistent with respect to a given set of integrity constraints. This 
may happen due, among others, to the following factors: (1) Certain ICs cannot 
be expressed/maintained by existing DBMSs. (2) Transient inconsistencies caused 
by the inherent non-atomicity of database transactions. (3) Delayed updates of a 
datawarehouse. (4) Integration of heterogeneous databases, in particular with du- 
plicated information. (5) Inconsistency with respect to soft integrity constraints, 
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where transactions in violation of their conditions are not prevented from execut- 
ing. (6) Legacy data on which one wants to impose semantic constraints. (7) The 
consistency of the database wiU be restored by executing further transactions. (8) 
User constraints than cannot be checked or maintained (9) No permission to restore 
consistency. (10) Inconsistent information can be useful. (11) Restoring consistency 
can be a complex and non deterministic process. 

An inconsistent database may be the only source of data, and we may still want 
or need to use it. In these cases, one faces the important problem of characteriz- 
ing and retrieving the consistent information from the database. Furthermore, the 
database can still provide us with correct answers to certain queries, making the 
problem of determining what kinds of queries and query answers are consistent with 
the integrity constraints a worthwhile effort. These problems have been studied in 
the context of relational databases and recent publications deal with some of the 
issues that arise from trying to define and retrieve consistent information from an 
inconsistent relational database. 

More specifically, in order to approach the problem of consistent query answering 
(CQA), in (Arenas et ai, 199£), a model theoretic definition of consistent answer to 
a query posed to an inconsistent database was introduced. The notion is based on 
the minimal repairs of the inconsistent database: an answer t to a first-order query 
Q{x) is consistent if it is an answer to the same query in every minimal repair 
of the database. A repair must be minimal in the sense that the set of inserted or 
deleted tuples (to restore inconsistency) is minimal under set inclusion. 

A possible computational mechanisms for retrieving consistent answers is as fol- 
lows: Given a first-order query Q and an inconsistent database instance r, instead 
of explicitly computing all the repairs of r and querying all of them, a new query 
T{Q) is computed and posed to r, the only available database. The answers to 
the new query are expected to be the consistent answers to Q. Iterative query 
transformation operators were introduced and analyzed with respect to soundness, 
completeness and termination in ( Arenas et a/., 1999 ; Gelle and Bertossi, 200(]| ). 

Nevertheless, the query rewriting approach has some limitations. The operators 
introduced in ( Arenas et ai, 1999 ; Celle and Bertossi, 2000 ) work for some particular 
classes of queries and constraints, e.g. they cannot be applied to disjunctive or 
existential queries. 

Furthermore, what we have so far is a semantic, model based definition of con- 
sistent query answer, based on database repairs, plus a computational mechanism. 
Nevertheless, we do not have a specification of the database repairs in a logical 
language of the class of all the repairs of a given database instance relative to a 
fixed set of ICs. Such a description is natural and useful if we want to express the 
explicit or implicit properties that are shared by all database repairs, e.g. consis- 
tent answers, without constructing those repairs explicitly. Actually, as shown in 
(Arenas et ai, 2001), it is easy to find situations where there is an exponential 
number of database repairs wrt the original database instance. In consequence, the 
specification would be a compact way of representing the whole class of database 
repairs. 

Prom such a specification, say Spec, we could: (1) Reason from Spec. (2) Consis- 
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tently answer queries by asking: Spec \= Q{x)7. (3) Obtain the intended models of 
Spec that should correspond to the database repairs. (4) Derive algorithms for con- 
sistent query answering. (5) Analyze complexity issues related to consistent query 
answering. In this paper, we are motivated mainly by the possibility of retriev- 
ing consistent answers to general first-order queries, extending the possibilities we 
developed in (Arenas et ai, 1999). We are also interested in the possibility of ob- 
taining the models of the specification, i.e. the database repairs. Having the repairs 
explicitly available, allows us to analyze different ways to restore the consistency of 
the database. That is, a mechanism for computing database repairs could be used 
for conflict resolution. 

Notice that consistent answers are non-monotonic in the sense that adding infor- 
mation to the original database, may cause loosing previous consistent answers. In 
consequence, a non-monotonic semantics for Spec (or their consequences) should 
be expected. 

In this direction, in (Arenas et ai, 2000b) a specification in annotated predicate 
calculus of the database repairs was presented. That specification was used to derive 
algorithms for consistent query answering and to obtain some complexity results. 
As expected, the database repairs correspond to certain minimal models of the 
specifications. This approach is based on a non-classical logic. 

In the same spirit, in (Arenas et ai, 2000a) an alternative specification of the 
database repairs was presented. It is based on extended disjunctive logic programs 
with an answer sets semantics. The the database repairs correspond to the intended 



models of the program. This paper extends the results presented in ( Arenas et al. 



2000a), addressing several new issues. 



Our main contributions are: (1) The introduction and application of extended 
disjunctive logic programs with exceptions to the specification of database repairs 
and consistent query answering. (2) A detailed analysis of the correspondence be- 
tween answer sets and database repairs for binary integrity constraints. (3) The use 
of the specification of database repairs to retrieve consistent answers to general first 
order queries. (4) An analysis of the applicability of the disjunctive well-founded 



semantics to consistent query answering. (5) Application of the DLV system ( Eiter 



et at, 1998 ) to obtain database repairs and consistent answers. (6) The use of 
weak constraints to capture database repairs based on minimal number of changes. 
(7) Extensions to of the methodology to more general universal constraints and to 
referential integrity constraints. 

This paper is structured as follows. In section || we introduce the notions of 
database repair and consistent answer to a query, and the query language. Sections 
^ introduces extended disjunctive logic programs with exceptions. In section ^ we 
show a complete, but informal example that describes the main ideas behind our 
approach to consistent query answering and specification of database repairs by 
means of logic programs. In section, || we present the repair programs in their 
general form for binary integrity constraints. In section |^ we analyze the well- 
founded interpretation as an approximation to the set of consistent answers, and 
we identify cases where it provides the exact solution. In section |7[ we discuss how to 
evaluate the queries. In section || we show some examples using the DLV system to 
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obtain database repairs and consistent answers. In section ^ we shown how database 
repairs based on minimal number of changes can be specified by introducing weak 
constraints in our repair programs. In section ^ we show by means of examples 
how to extend the methodology to deal with more general universal constraints 
and referential integrity constraints. In section ^ we discuss related work, mention 
some open issues, and draw conclusions. 



2 Consistent Query Answers 

A relational database instance r can be represented by a finite set of finite relations 
whose names are part of a database schema. A database schema can be represented 
by a typed language C of first-order predicate logic, that contains a finite set of 
sorted predicates and a fixed infinite set of constants D. The language contains 
a predicate for each database relation and the constants in D correspond to the 
elements in the database domain, that we will also denote by D. In consequence, 
every database instance has an infinite domain D. 

The active domain of a database instance r is the set of those elements of D 
that explicitly appear in r. The active domain is always finite and we denote it by 
Act{r). We may also have a set of built-in (or evaluable) predicates, like equality, 
order relations, arithmetical relations, etc. In this case, we have the language C 
possibly extended with these predicates. In all database instances each of these 
predicates has a fixed and possibly infinite extension. Of course, since we defined 
database instances as finite sets of ground atoms, we are not considering these 
built-in atoms as members of database instances. 

In addition to the database schema and instances, we may also have a set of 
integrity constraints IC expressed in a language C. These are first-order formulas 
which the database instances are expected to satisfy. 

If a database instance r satisfies IC, what is denoted by r |= IC, we say that 
it is consistent (wrt IC), otherwise we say it is inconsistent]^ In any case, we will 
assume from now on that IC is consistent as a set of first-order sentences. 



The original motivation in ( Arenas et ai, 1999 ) was to consistently answer first 



order queries. We will call them basic queries and are defined by the grammar 

B ::= Atom \ B A B \ ^B \3x B. 

One way of explicitly asking at the object level about the consistent answers to a 
first-order query consists in introducing a new logical operator IC, in such a way 
that ICip{x), where f{x) is a basic query, asks for the values of x that are consistent 
answers to ip{x) (or whether if is consistently true, i.e. true in all repairs, when tp 
is a sentence). The IC-queries are similarly defined: 

A :■= ICB \ AaA\^A \ 3x. A. 

In this paper we will concentrate mostly on answering basic IC-queries of the form 



^ It is natural to see a relational database instance also as a structure for interpretation of language 
C, in consequence, the notation r \= IC makes sense. 
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ICB, where _B is a basic query, but in section ^ we sketch how to handle general 
/C-queries. 

Definition 1 



(a) ( Arenas et ai, 1999 ) Given a database instance r (seen as a set of ground atomic 
formulas) and a set of integrity constraints, IC, a repair of r wrt IC is a database 
instance r', over the same schema and domain, that satisfies IC and such that rAr', 
the symmetric difference of r and r', is minimal under set inclusion. 



(b) ( Arenas et ai, 1999 ) A tuple t is a consistent answer to a first-order query Q{x), 
or equivalently, an answer to the query ICQ{x), in a database instance r iff f is an 
answer to query Q{x) in every repair r' of r wrt IC. In symbols: 



r' 1= (5[t] for every repair r' of 



(c) If Q is a general /C-query, then r |= Q is defined as usual, (b) being the base 
case. □ 



Example 1 

Assume there is the following database instance Salary 



Salary 



Name Amount 



V .Smith 

V .Smith 
P .Jones 
M.Stone 



5000 
8000 
3000 
7000 



and FD is the functional dependency Name Amount, meaning that Name 
functionally determines Amount, that is violated by the table Salary, actually by 
the tuples with the value V.Smith in attribute Name. 
The possible repairs are 



Salary j 



Name Amount 



Salary f 



V .Smith 
P.Jones 
M.Stone 



5000 
3000 
7000 



Name 
V .Smith 
P.Jones 
M.Stone 



Amount 
8000 
3000 
7000 



Here, t^ — {P. J ones, 5000) is a consistent answer to the query Salary{x), i.e. 
r K Salary{x,y)[{P. Jones, iOOO)], but r ^ K S alary {x,y)[{V .Smith, 8000)]. 
It also holds r ^ /C {S alary {V .Smith, hOOO) V S alary {V .Smith, B,000)), and 
r[^lC 3X{Salary{ V.Smith, X) ^ X > 4000). □ 



Notice that the definition of consistent query answer depends on our definition 
of repair. In section 9.1 we will consider an alternative definition based on minimal 
number of changes instead of minimal set of changes. 

Computing consistent answer through generation of all possible repairs is not a 
natural and feasible alternative (Arenas et ai, 2001). Instead, an approach based 
on querying the available, although inconsistent, database is much more natural. 
In ( Arenas et ai, 199S| ) a query rewriting iterative operator T was introduced, that 
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applied to a given query Q produces a new query T[Q) whose (ordinary) answers 
in an instance r are the consistent answers to Q in r. 

Example 2 

(example Q continued) The functional dependency FD can be expressed by means 
of the formula \lxyz {-i S alary {x,y) V -^Salary{x, z) V y — z). Given the query 
Q{x,y) : Salary{x,y), the consistent answers are: {P. Jones, 3000), {M.Stone, 7000), 
but not {V. Smith, 5000), {V.Smith, 8000). 

The consistent answers can be obtained by means of the transformed query 
T{Q{x,y)) := Salary{x,y) A Vz {-> S alary {x, z) W y — z) posed to the given 
instance. □ 



This rewriting approach is not complete for disjunctive or existential queries, like 
3Y Salary{V .Smith, Y). We would like to be able to obtain consistent answers to 
basic /C-queries at least. 



3 Logic Programs with Exceptions 



Logic programs with exceptions (LPEs) were first introduced in (Kowalski and 



^adri, 19911) . They are built with definite extended clauses, that is, with clauses 



where the (non-disjunctive) head and the body are literals (with classical negation) 



and weak negation (or negation as failure) may appear in the bodies (Gelfond and 



Lifschitz, 1991). Among those clauses, in a LPE there are positive default rules, that 
is clauses with positive heads, whose conclusions can be overridden by conclusions 
derived from exception rules, which are clauses with negative heads. 

The idea is that exceptions have priority over defaults. To capture this intuition, 
a new semantics is introduced, E-answer sets. 

Example 3 

As an example of LPE, we present here a program 11 that cleans a database 
instance r{X, Y) from tuples participating in the violation of the FD X ~^Y . We 
start by introducing a new predicate r'{X, Y) that will store the tuples in the clean 
version of the database. 

1. Default rule: r'{X,Y)< — r{X,Y). 

It says that every tuple {X,Y) passes from r to r' . 

2. Negative exception rule: --r'{X, Y) < — r{X, Y),r{X, Z), not Y = Z. 

It says that tuples {X, Y) where X is associated to different values are not 
accepted in the clean table. 

3. Facts: the contents of r plus X = X < — . 

Intuitively, rule 2. should have a priority over rule 1. □ 



The semantics of the program should give an account of the priorities; they should 
be refiected in the intended models of the program. 

The semantics is constructed as follows. First, instantiate the program 11 in 
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the database domain, making it ground. Now, let be a set of ground literals 
S = {L, ...}. In example ^, S could be something like {r{a,b),-'r{a,b),r'{a,b), 
-ir' {a,b), a — b,^a — 6,...}. This S* is a candidate to be a model, a guess to be 
verified, and accepted if properly justified. 

Next, generate a new set of ground rules "^11 according to the following steps: 

(a) Delete every rule in 11 containing not L in the body, with L G 5*. 

(b) Delete from the remaining clauses every condition not L in the body, when 

(c) Delete every rule having a positive conclusion L with L G S. 

The result is a ground extended logic program without not. Now, we say that S 
is an e-answer set of the original program if 5* is the smallest set of ground literals, 
such that 

• For any clause Lq < — Li, ■ • ■ , L,„ in "^11, if Li, ■ • • , Lm G S, then Lq G S. 

• If contains two complementary literals, then S is the set of all literals. 

The e-answer sets are the intended models of the original program. In example 
^, the only e-answer set is essentially the cleaned instance, what is reflected in the 
existence of only one e-answer set, where the extension of r' is that of r, but without 
its conflicting tuples. Notice that this instance is not a repair, but the intersection 
of all repairs. 

Above, (a) - (b) are as in the answer sets semantics for extended logic programs 
( pelfond and Lifschitz, 1991 ), but now (c) gives an account of exceptions. 



In order to specify database repairs, we need to extend the LPEs as presented 



in (Kowalski and Sadri, 1991) in order to accommodate also negative defaults, i.e. 
defaults with negative conclusions that can be overridden by positive exceptions, 
and extended disjunctive exceptions, i.e. rules of the form 

Li V • • • V Lfc < — Lk+i, ■ ■ ■ ,Lr,not Lr+i, ■ ■ ■ ,not Lk, 

where the L^s are literals. In our application scenario we will need disjunctive 
exceptions rules, but not disjunctive defaults. 

The e-answer semantics is extended as follows. The ground program is pruned 
according to a new version of the rule (c) we had in the previous section: 

(c') Delete every (positive) default having a positive conclusion L, with -li £ 5; 
and every (negative) default having a negative conclusion -iL, with L £ S. 

Applying (a), (b) and (c') to the ground program, we are left with a ground 
disjunctive logic program without not. If the candidate set of literals S belongs to 
a('^n), the set of minimal models of program '^11, then we say that S is an e-answer 
set. 



As described in (Kowalski and Sadri, 1991) for non-disjunctive programs with 



negative exceptions, there is a one to one correspondence between the e-answer sets 
of a disjunctive logic program with exceptions and the answer sets of an extended 



disjunctive logic program (Gelfond and Lifschitz, 1991). It is easy to show a gen- 



eral program transformation that establishes this correspondence. We will give this 
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transformation in section 5.1, remark |l], but only for the programs we will use. As 



shown in ( Gclfond and Lifschitz, 19"9l| ), the extended disjunctive program obtained 
after the transformation can be transformed in its turn into a disjunctive normal 
program (without classical negation) with a stable model semantics. 



4 Logic Programs for CQA: An Example 

Now, we will use logic programs with exceptions for answering basic /C-queries. 

Given a set of ICs and an inconsistent database instance r, the first step consists 
of writing a logic program n(r) having as e-answer sets the repairs of the original 
database instance. For this purpose, we will use the disjunctive logic program with 
exceptions (DLPEs) introduced in section ||. With those repair programs we can 
specify the class of all the repairs of a given inconsistent database instance. Next, if 
a first-order query is posed with the intention of retrieving all and only its consistent 
answers, then a new logic program, a query program, that expresses the query, is 
run together with the repair program. In this way we can pose and consistently 
answer queries we can not handle with the query rewriting approach presented in 
([Arenas et al, 19991). 



4 ■ 1 The repair program 

Program 11 (r) captures the fact that when a database instance r is repaired most 
of the data persists, except for some tuples. In consequence, default rules are intro- 
duced: everything persists from the instance r to the repairs. It is also necessary to 
introduce exception rules: everything persists, as stated by the defaults, unless the 
ICs are violated and have to be satisfied. 

We illustrate repair programs by means of an example. 

Example 4 

Consider an inclusion dependency IC : yxy {P{x, y) Q{x, y)), stating that every 
tuple in table P has to be also a tuple in table Q, and the inconsistent database 
instance r = {P{a, b), Q{b, c)}. The repairs of the database are specified by a DLFE 
n(r) obtained as follows: we introduce new predicates P' , Q' corresponding to the 
repaired versions of the original tables, plus the following program clauses: 

1. Facts: P{a,b), Q{b,c). 

2. Triggering exception: -^P'{X,Y) V Q'{X,Y) ^ P{X,Y), not Q{X,Y). 

This rule gives an account of the first two possible steps leading to a repair of 
the DB: in order to "locally" repair the (in this case, single) IC, either elim- 
inate {X,Y) from P or insert {X,Y) into Q. The semantics of these DLPEs 
gives the disjunction an exclusive interpretation. We use weak negations in 
the body of the last rule in order to give an account of the closed world as- 
sumption. 
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3. Stabilizing exceptions: Q'{X,Y) ^ P'{X,Y); ^P'{XX} ^ ^Q'{X,Y). 

This rule states that eventually the IC has to be satisfied in the repairs, this 
kind of exceptions are necessary if there are interacting ICs and local repairs 
alone are not sufficient. The contrapositive is introduced for technical reasons. 

4. Persistence defaults: P'{X,Y) ^ P{X,Y): Q'iX,Y) ^ QiX,Yy, 

-^P'{X,Y) ^ not P{X,Y); -^Q'{X,Y) ^ not Q{X,Y). 
This means that, by default, everything from r is put into r' and nothing else. 
Rules 2. and 3. have priority over rule 4. 

It is possible to verify that the e-answer sets of the program are the expected 
database repairs: { ^P'{a,b) , ^Q'{a, b),Q'{b, c),P{a, b), Q{b, c)}; {P'(a, b), Q^(a,6) , 
Q'{b, c), P(a, 6), c)}. The underlined literals represent the deletion of P(a, b) in 
one repair and the insertion of Q{a,b), in the other, resp. Notice that P{a,b) and 
Q{b, c) do not change, because there is no rule able to do that. □ 



4-2 The query program 

In order to obtain the consistent answers to a first-order query (p{x), this query 
is translated into a stratified logic program !!((/?) with new query goal Query{x) 



using a standard methodology (Lloyd, 1987). The predicates appearing in the query 



program n((p) will be the repaired, primed versions of the original database tables, 
more precisely the set of consistent answers to ^p{x) will be the set {t \ Query{t) G 
M, for every e-answer set M of n(r) U Ii{(f)}. 

Example 5 

(example ^ continued) The query ^i{x) : P(x, a) V (5(a, x), asking for consistent 
values of x in the database instance, can be transformed in the following query 
program Tl{ifi): 

QueryiX) < — P'{X,a) 
Query{X) ^ Q'{a,X) 

In order to obtain consistent answers it is necessary to evaluate the query goal 
Query{x) wrt the combined program Ii{ipi) U n(r). Each of the e-answer sets of 
the combined program will contain a a set of ground Query-atoms. Those Query- 
atoms (rather their tuple arguments) that are present simultaneously in all the 
e-answer sets will be the consistent answers to the original query. 

As another example of query, consider ^P2{y) '■ ^xQ{x,y). In order to obtain the 
consistent answers, we keep n(r), but we run it in combination with the new query 
program n((^2): 

Query{Y) ^ Q'{X,Y). □ 
Queries like the ones in the previous example can not be handled by the rewriting 



methodology presented in (Arenas ct ai, 1999) 
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5 DLPEs for Binary Integrity Constraints 

In this section we will introduce the DLPEs for specifying database repairs, and 
will give a careful analysis of those programs for consistent query answering wrt 
binary integrity constraints (BICs). 

We represent integrity constraints in the standard format ( Arenas et at, 1999| ) 



m 



y p^(x,)\J\/ ^q,{yi)\J ^, (1) 

i=l i=l 

where the Pi,(7i are atomic database formulas, where is a first-order formula 
containing only built-in predicatesQ only and whose variables are among the Xi, ytS] 
and there is an implicit universal quantification in front. 

Binary integrity constraints arc in this standard format, but they have the re- 
stricted syntactic form 

V5 (Li VLsVvj), (2) 

where Li,L2 are database literals associated to database tables, i.e. atomic or 
negations of atomic formulas whose predicates are part of the database schema. 
That is, in (|l|) the conditions < n,m, 1 < n + m < 2 hold. 

We represent BICs in this form, as a particular case of the general standard 
format, because it is easy to generalize the program we will give next for BICs to 
the general case. Nevertheless, in this paper we will concentrate mainly on BICs. 

BICs with one database literal plus possibly a formula containing built-ins are 



called unary ICs. Several interesting classes of ICs (Abiteboul et ai, 1995) can be 
represented by BICs: (a) range constraints, e.g. P{x,y) x > b; (b) non existen- 
tial inclusion constraints (example (b) functional dependencies (examples |l|, 
etc. Nevertheless, for referential ICs, like in P(x, y) 3zQ{x, z), we need existen- 
tial quantifiers or Skolem functions ( Fitting, 1996| ). We briefly consider existential 
inclusion dependencies in section |l^. 



5.1 Finite domain databases 

In this section we will first analyze the case of finite domain databases. That is, in 
this section, we will momentarily depart from our initial assumption that databases 
have an infinite domain D (see section |l|). The reason is that in the general case, we 
will be interested in domain independent BICs, for which only the active domain is 
relevant (and finite). 



5.1.1 The change program 

In the following, in order to analyze the behavior of DLPEs for BICs, we will sepa- 
rate the default rules of the programs from the other rules that represent exceptions. 



^ Built-in predicates have a fixed extension in every database, in partiniilar, in eve ry repair; so 
they are not subject to repairs. More details can be found in (Arenas et ai, 1999). 
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We will concentrate first on the program without the defaults, that we will denote 
by ^Aij")- This is the part of the program responsible for the changes. 

Splitting the program in this way makes its analysis easier. In addition, we will 
see that keeping nA(?'), but using different form of defaults, we can capture different 
kinds of repairs. In this section, we will use defaults (def ^ that lead to our notion 
of repair based on minimal set of changes (def |l|). In section 3.1, we will use other 
defaults that lead to repairs based on minimal number of changes. 

Definition 2 

Given a set of BICs IC and an instance r, the change DLPE, IIaC?'), contains the 
following rules: 

1. Facts: 

(a) For every atomic database formula p(a) such that r ^ p{a), the fact p{a). 

(b) For every a in D, the fact dom{a). 

2. For every IC of the form (|l|), the triggering rule 



i=l i^l 

71 m 

dom{Xi, . . . ,Xn) , notpi{Xi), f\qi{Yi), not ip. 

i=l i=l 

3. For every 1 < j < n, the stabilizing rule 

j — l n rn 

dom{Xi, . . . , Xn, Fi, . . . , Ym) , ^p'^{Xj), not ip. 
For every 1 < j < m, the stabilizing rule 

n j — l m 

\jp[{x^)y\j ^qmv v -^q'm^ 

dom(Xi,... ,Xn,Yi,... ,Yrn), q'jiY]), not ip. 

In these rules, dom{Xi, . . . ,X„) is an abbreviation for the conjunction of cases of 
membership to dom of all the components in the XiS. Of course, depending on the 
syntax, it may be necessary to unfold the formula ip appearing in the bodies in 
additional program rules, but p will usually be a conjunction of literals. □ 



Notice that the sets of rules 2. and 3. in example ^ have the form of these general 
triggering and stabilizing rules, respectively. 

It is always the case that for BICs, the stabilizing rules in IlA{r) do not contain 
disjunctions in the heads. This can also be seen in example ^. Only triggering rules 
are properly disjunctive. 
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Definition 3 

A model of a DLPE, IT, is a set of ground literals, S, that does not contain comple- 
mentary literals and satisfies 11 in the usual logical sense, but with weak negation 
interpreted as not being an element of S. □ 

Definition 4 

Given a model S of IlA{r), we define the database instance corresponding to S by 
7(5) = {p{a) I p'{a) G S} U {p{a) \ p{a) e S and ^p'{a) ^ S)}. □ 



Notice that, for a given model S of the change program, I{S) merges in one new 
instance of the schema all the positive primed tuples with all the old, non primed 
tuples that persisted, i.e. that their negative primed version do not belong to the 
model. Since we do not have persistence defaults in nA(r), persistence is captured 
and imposed through I{S), by keeping in it all the atoms from the original database 
that were not discarded via the primed predicates. 

Proposition 1 

Given a database instance r and a set of BICs IC, if 5* is a model of liAif), then 
I{S) satisfies IC. □ 



Definition 5 

Given database instances r and r' over the same schema and domain, wc define 

Siry) = {p{a) I r hp(«)} U {p\a) | r' ^ p{a)} U {V(a) | r' ^ p{a)} 

U {dom{a) \ a e D}. □ 

S{r, r') collects the maximal set of literals that can be obtained from two database 
instances. It contains everything from both r and r' . The atoms corresponding to the 
second argument are primed. Negative literals corresponding to the first argument, 
intended to be the original databases instance, are not considered, because we will 
apply weak negation to them. 

Proposition 2 

Given a database instance r and a set of BICs IC, if r' satisfies IC , then S{r,r') 
is a model of Il/^{r). □ 



In the following we will be considering subsets of S{r,r'). The previous result 

tells us that its subsets can be potential models of the program. S{r,r') can be a 
large model, in the sense that the difference between r and r' may not be minimal. 

Proposition 3 

For BICs, the change program nA(r) has an answer set. □ 
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5.1.2 The repair program 

Program IlAir) gives an account of the changes in the original instance that are 
needed to produce the repairs, but the actual repairs contain data that persists 
from the original instance. This can be captured by adding persistence defaults. 

Definition 6 

The repair program n(r) consists of the rules in program TlA(r) (def. H) plus the 
following two rules for each predicate p in the original database: 

4. Persistence defaults 

p\X) <— p{X) 
^p'{X) < — dom{X), p{X). U 

Remark 1 



As shown in ( Kowalski and Sadri, 1991 ), the DLPE 1.-4., which has an e-answer se- 
mantics, can be transformed into a disjunctive extended logic program with answer 
set semantics, by transforming the persistence defaults into 

4'. Persistence rules 

p'{X) ^ p{X), not^p'iX) 
^p'{X) < — dom{X), notp{X), notp'{X). 

As shown in ( Gelfond and Lifschitz, 199l| ), the resulting extended disjunctive nor- 



mal program can be further transformed into a disjunctive normal program with a 
stable model semantics, with a one to one correspondence between answer sets and 
stable models. For this reason, we will interchangeably use the terms answer sets 
and stable models. □ 

Proposition 4 

Given a database instance r over a finite domain, and a set of BICs IC, if Sm is 
an answer set^ of Ha {r) , then 

S* = S'a/ U {p'{a) I p{a) £ Sm and V(a) ^ Sm} U 

{ I ^ Sm and p'{a) ^ Sm} (3) 
is an answer set of n(r). □ 



In order to establish the correspondence between the answer sets of the repair 
program Tl{r) and the repairs of r, we need the following lemma. It says that 
whenever we build an answer set S with literals taken from S{r, r'), and r' satisfies 
the ICs and is already as close as possible to r, then in S we can get essentially r' 
only. The condition that S is contained in S'(r, r') makes sure that the literals in S 
are taken from the right, maximal set of literals. 



In the programs we are considering so far, namely nA(f ) and n(r) with persistence rules instead 
of persistence defaults, we do not find any defaults. In consequence, we ran talk ahout answer 
sets as in (Gelfond and Lifschitz, 1991) instead of e-answer sets (Kowalski and Sadri, 1991). 
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Lemma 1 

Let r and r' be database instances over the same schema and domain, and /C, a set 
of BICs. Assume that r' |= IC and the symmetric difference A(r, r') is a minimal 
element under set inclusion in the set {A(r, r*) | r* \= IC}. Then, for every answer 
set S of Ii^{r) contained in S'(r, r'), it holds r' = I{S). □ 



Theorem 1 

If n(r) is the program Iii\{r) plus rules 4'., for a finite domain database instance r 
and a set of BICs /C, then it holds: 

1. For every repair r' of r wrt /C, there exists an answer set S of n(r) such that 
r' = {p{a) I p'(a) e 

2. For every answer set S of 11 (r), there exists a repair r' of r wrt IC such that 
r' = {p(a) 1 p'(a) G 5}. □ 

In the case of finite domain databases, the domain can be and has been declared. 
In this situation, we can handle any set of binary ICs, without caring about their 
safeness or domain independence. 

Example 6 

Let us take D = {a, 5, c}, r = {p(a)} and IC ~ {ixp{x)}. In this case, the program 
n(r) is 

p'{X) ^ p{X),not^p'{X) 

^p'{X) < — dom{X),not p{X),not p'{X) 

p'{X) < — dom{X),not p{X) 

p'{X) < — dom{X) 

dom{a) < — 

dom{b) < — 

dom(c) < — 

p{a) < — 

The only answer set is {dom{a), dom{b), dom{c),p{a),p' {a),p' {b),p' (c)}, that cor- 
responds to the only repair r' = {p{a) , p{b) , p{c)} . □ 

In this example, the IC demands that every element in domain D belongs to table 
p; and this is possible to satisfy because the domain is finite. Nevertheless, if the 
domain D were infinite this would not be possible, because relational tables contain 
finitely many tuples. So, this kind of ICs cannot be handled in infinite domains. 

5.2 Infinite domain databases 



Now we consider only ICs that are domain independent (UUman, 198S). For these 



ICs only the active domain matters. In particular, checking their satisfaction in an 
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instance r can be done considering the elements of Act{r) only. The IC in example 
^ is not domain independent. 

For domain independent BICs all previous lemmas and theorems still hold if we 
have infinite database domains D. To obtain them, all we need to do is to use a 
predicate actr{x), standing for the active domain Act(r) of instance r, instead 
of predicate dom{x). This is because, for domain independent BICs, the database 
domain can be considered to be the finite domain Act{r). Furthermore, in this case 
we can omit the dom facts in 1. of Tl /^{r) (definition |^) . I n consequence, we have 



the following theorem, first stated in ( [Arenas et ai, 2000a|) 



Theorem 2 

For a set of domain independent binary integrity constraints and a database instance 
r, there is a one to one correspondence between the answers sets of the repair 
program Ii{r) and the repairs of r. □ 

As a consequence of this general result, we have that our DLPEs n(r) correctly 
specify the repairs of relational databases that violate usual integrity constraints 
like range constraints, key constraints, functional dependencies, and non-existential 
inclusion dependencies. 



6 Weil-Founded Consistent Answers 

Computing the stable model semantics for disjunctive programs is Ilf -complete in 
the size of the ground program^. In some cases, computing consistent answers can 
be done more efficiently. 

The intersection of all answer sets of a extended disjunctive logic program con- 



tains the well-founded interpretation for such programs (Leone et at, 1997), that 
can be computed in polynomial time in the size of the ground program. This inter- 
pretation may be partial and not necessarily a model of the program. Actually, it 
is a total interpretation if and only if it is the only answer set. 

The well-founded interpretation, Wn(r) =< W'^,W~ >, of program n(r), where 
,W~ are the sets of true positive, negative, unknown literals, resp., is 
the given by the fi xpoint Wj^c^-)(0) o f operator Wn(r)j that maps interpretations 



to interpretations ( Leone et al, 1997| ). More precisely, assuming that we have the 



ground instantiation of the repair program 11 (r), Wn(r)(^) is defined on interpre- 
tations / that are sets of ground literals (without pairs of complementary literals) 
by: WnM(/) := Tn^^) U ^.GUSnir){I)- 

Intuitively, rn(r) is the immediate consequence operator that declares a literal 
true whenever there is ground rule containing it in the head, the body is true in I 
and the other literals in the (disjunctive) head are false in /. ^.G'J75'n(r)(-^) denotes 
the set of complements of the literals in G[/S'n(r)(-^)i being the latter the largest set 
of unfounded literals, those that definitely cannot be derived from the program and 
the set / of assumptions; in consequence their complements are declared true. The 



* See (Dantsin et al., 200?) for a review of complexity results in logic programming. 
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well-founded interpretation, T4^n(r)i is the least fixpoint VVj^(.,^>(0) of >Vn(r)- More 



details can be found in (Leone et ai, 1997) 



The intersection of all answer sets of n(r) is 

Core(n(r)) := f^{S \ S is an answer set of n(r)}. 

Interpretation Wu, being a subset of Core(n(r)), can be used as an approximation 
from below to the core that can be computed more efficiently than all database re- 
pairs, or their intersection in the general case. Nevertheless, it is possible to identify 
classes of ICs for which Wuir) coincides with Core{Il{r)). In these cases, the core 
is no longer approximated by W^n(r)i but computed exactly. 



In order to prove these results, we will assume, as in section 5.1, that we have 
a finite database domain D. We know that the results obtained under this hy- 
pothesis still hold for infinite domain databases and domain independent integrity 
constraints. In consequence, program Tl{r) contains domain predicates. The do- 
main facts belong to every answer set and are obtained after the first iteration of 
the well-founded operator. 

Proposition 5 

For a database instance r, and a set of ICs containing functional dependencies and 
unary ICs only|, the Core{Il{r)) of program n(r) coincides with Wufr), the well- 
founded interpretation of program n(r). □ 



As corollary of this proposition and results presented in (Leone et al, 1997) 
about the computational complexity of the disjunctive well-founded interpretation, 
we obtain that, for FDs and unary constraints, Core(Il{r)) can be computed in poly- 
nomial time in the size of the ground instantiation of n(r), a result first established 



in (Arenas et al, 2001) for FDs. In particular, we can consistently answer non- 



existential conjunctive queries in polynomial time, because we can use Core(n{r)) 



only. Furthermore, in ( Arenas et ai, 2001 ), for the case of functional dependencies 



some conditions on queries are identified under which one can take advantage of 
computations on the core to answer aggregate queries more efficiently. 

For programs of the kind we may have for BICs, it is not always the case that 
the core coincides with the well-founded interpretation. 

Example 7 

Consider the BICs IC ~ {q'Vr, s V -ig, s V ^r} and the empty database instance. 
The program Tl{r) wrt IC is 



^ Remember that they are BICs with at most one database hteral in the standard format 
plus built-ins. They include range constraints, e.g. stock(x) — > 100 < a;, stating that products 
in stock may not go below 100 units. 



Answer Sets for Consistent Query Answers 



17 



Triggering rules: 



Stabilizing rules: 



Persistence rules: 



q'Wr' 
s' V -^q' 
s V ^r 



not q, not r 
not s, q 
not s, r 



-IS 



-■s 



q,not -iq' 
s, not -is' 
r. not -^r' 
not q, not q' 
not s, not s' 
not r, not r' . 



The answer sets are: {q',s',^r'} and {^q',s',r'}. Then Core{U{r)) = {s'}, but 
Wnir) =0- □ 

The rcsuhs obtained so far in this section apply to the repair program 11 (r). 
Nevertheless, when we add an arbitrary query program Il{Q) to n(r), obtaining 
program 11, then it is possible that Core (11) properly extends the well-founded 
interpretation of 11, even for FDs. 

Example 8 

Consider r = {P(a, h), P{a, c)}, the FD: P{x, y) V P{x, z)\l y = z, and the query 
Q{x) : 3y P{x, y). Program 11 is: 



dom{a) 
dom{b) 

dom{c) 
P{a,b) 
P{a,c) 

Query{X) 
P'{X,Y) 

-^P'iX,Y) 



P'{X,Y) 

P{X,Y),not -P'(X, Y) 
dom{X),dom{Y),not P{X,Y),not P'{X, Y) 
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-^P'{X,Y)V ^P'{X,Z) ^ P{X,Y),P{X,Z),Y ^ Z 

-^P'{X,Y) ^ dom{X),dom{Y),dom{Z),P'{X,Z),Y ^ Z 
^P'{X,Z) ^ dom{X),dom{Y),dom{Z),P'{X,Y),Y =^ Z. 

The answer sets of IT are Si = {Query{a), P'{a, b), P{a, 6), P(a, c), . . . } and 5*2 = 
{Query{a), P'{a, c),P{a, b),P{a, c), . . . }. The well-founded interpretation is Wn 
=< W+,W-,W'' >, with W+ = {P{a, b), P{a, c),dom{a), ...},W-= {^P'{a, a), 
...}, and implicitly, the set of undetermined literals = {P'{a,b), P'{a,c), 
Query{a)}. In particular, Query{a) G Core(n), but Query{a) ^ W~^. □ 



We know, by complexity results presented in (Arenas et al., 2001) for functional 
dependencies that, unless P = NP, consistent answers to first-order queries cannot 
be computed in polynomial time. In consequence, we cannot expect to compute 
the Core(n) of the program that includes the query program by means of the 
well-founded interpretation of 11 only. 



7 Evaluating /C-queries 

The results in section ^ provide the underpinning of a general method of evaluating 
/C-queries. Assume r is a database instance and the set of integrity constraints 
IC is given. We show how to evaluate queries of the form (3 = /Ca where a is 
a basic query. First, from a we obtain a stratified logic program n(Q;) (this is a 
standard construction (Lloyd, 1987; Abiteboul et ai, 1995| )) in terms of the new, 
primed predicates. One of the predicate symbols. Query ^, of n(a) is designated 
as the query predicate. This is illustrated in section L2. Second, determine all the 
answers sets ^i, . . . , S'fe of the logic program 11 n(a) U n(r). Third, compute 
the intersection r/j = C\i<n<i}^ Si/ Query ^, where Si/ Query ^ is the extension of 
Query ^ in Si. The set of tuples rp is the set of answers to (3 in r. 

Notice that the set U consisting of all the ground primed database literals, 
(^)p'(a), and all the ground non primed database literals, (-i)p(a), form a par- 
tition for the program 11, because whenever a literal in U appears in a head, all the 
literals in the body also appear in U ( Lifschitz and Turner, 1994 ). The set U par- 
titions the program precisely into the two expected parts, n(r) and H{Q), because 
the literals in U do not appear in heads of rules in I\-{Q) (for n((3), literals in U are 
like extensional literals). From (Lifschitz and Turner, 1994), we know that every 
answer set of 11 can be represented as the union of an answer set of 11 (r) and an 
answer set of n((5), where each answer set for n(r) acts as an extensional database 
for the computation of the answer sets of I\-{Q). Program I\-{Q) is stratified, in 
consequence, for each answer set for n(r), there will only one answer set for H{Q). 

To obtain query answers to general /C-queries the above method needs to be com- 
bined with some method of evaluating first-order queries. For example, safe-range 
first-order queries ( Abiteboul et al., 1995| ) can be translated to relational algebra. 
The same approach can be used for K, queries with the subqueries of the form /Ca 
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replaced by new relation symbols. Then when the resulting relational algebra query 
is evaluated and the need arises to materialize one of the new relations, the above 
method can be used to accomplish that goal. 

8 Computational Examples 



As shown in section 5.1, our disjunctive programs with exceptions can be trans- 



formed (Kowalski and Sadri, 1991) into extended disjunctive logic programs with an 



answer set semantics (Gelfond and Lifschitz, 1991). Once this transformation has 



been performed, obtaining program n(r), it is possible to use any implementation 
of extended disjunctive logic programs with answer set semantics. In this section. 



we give some examples that show the application of the Z^LF system (Eiter et al 



1998) to the computation of database repairs and consistent query answers. 



In (Leone et ai, 1997) it is shown how to compute the answer sets of a program 
starting from the well-founded interpretation, that can be efficiently computed and 
is contained in the intersection of the answer sets. This is what basically does, 
but instead of starting from the well-founded interpretation, it starts from the also 
efficiently computable set of deterministic consequences of the program, that is 
still contained in the intersection of all answer sets, and in its turn, contains the 



well-founded interpretation ( |Lconc, 200C| ). Actually, DLV can be explicitly asked 



to return the set of deterministic consequences of the program^, and it can be also 
used as an approximation from below to the intersection of all answer sets. 

8.1 Computing database repairs with DLV 

Example 9 

Consider a database schema Emp{Name, SSN). Each person should have just one 
SSN and different persons should have different SSNs. That is, the following func- 
tional dependencies are expected to hold: Name SSN, SSN Name. The 
following is an inconsistent instance: 



Emp 



Name SSN 



Irwin Koper 677-223-112 
Irwin Koper 952-223-564 
Michael Baneman 334-454-991 



In order to consistently query this database, we can generate the following DLV 
program, where the prime predicate Emp', containing the repaired extension, we 
had before is now denoted by empjp 

'/, domains of the database 

dom_name (" Irwin Koper"). dom_name( "Michael Baneman"). 

dom_number("677-223-112") . dom_number ("952-223-564") . 
dom_number(" 334-454-991") . 



By means of its option - det. 
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'/, initial database 

empC'Irwin Koper" , "677-223-112"). 

emp("Irwin Koper", "952-223-564"). 
emp( "Michael Baneman" , "334-454-991"). 



% default rules 

emp_p(X,Y) :- emp(X,Y), not -emp_p(X,Y) . 

-emp_p(X,Y) :- dom_name (X) , dom_number (Y) , not emp(X,Y), not emp_p(X,Y). 



% triggering rules 

-emp_p(X,Y) V -emp_p(X,Z) :- emp(X,Y) , emp(X,Z), Y!=Z. 
-emp_p(Y,X) V -emp_p(Z,X) :- emp(Y,X) , emp(Z,X) , Y!=Z. 

'/, stabilizing rules. 

-emp_p(X,Y) :- emp_p(X,Z) , dom_number (Y) , Y!=Z. 
-emp_p(Y,X) :- emp_p(Z,X), dom_name (Y) , Y!=Z. 



running on this program delivers two answer sets, corresponding to the two 
following repairs: 



Emp 



Name 



SSN 



Irwin Koper 
Michael Baneman 



952-223-564 
334-454-991 



Emp Name SSN 

Irwin Koper 677-223-112 
Michael Baneman 334-454-991 



In order to pose the query Emp{X, Y)7, asking for the consistent tuples in table 
Employee, it is necessary to add a new rule to the program: 

query (X,Y) :- emp_p(X,Y) . 

Now, the two answer sets of the program will contain query literals, namely 

{ query("Irwin Koper", "952-223-564"), 

query ("Michael Baneman" , "334-454-991")} 

{ query("Irwin Koper" , "677-223-112") , 

query ("Michael Baneman" , "334-454-991")} 

In order to obtain the consistent answers to the query, it is sufficient to choose 
all the ground query atoms that are in the intersection of all answer sets of the 
program extended by the query rule. In this case, wc obtain as only consistent 
answer the tuple: X="Michael Baneman", ¥="334-454-991". Here we had a non- 
quantified conjunctive query. In other cases, the query predicate will be defined by 
a more complex program 11 (Q). □ 
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9 An Alternative Semantics 



As discussed in (Arenas et al, 1999D , our notion of database repair coincides with 



that of revision model obtained with the "possible model approach" introduced by 
Winslett in ( Winslett, 198§| ) (see also ( |Chou and Winslett, 1994 )) in the context 



of belief update, when the database instance (a model) is updated by the ICs, 
generating a new set of models, in this case, the database repairs. In consequence, 
we have shown in section 5.1 that our repair program 11 (r) (cf. theorem |l|) has 



as its answer sets the Winslett 's revision models of r wrt IC. 



9.1 Cardinality based repairs and weak constraints 



Winslett's revision models are based on minimal set of changes. In (Dalai, 1988), 
Dalai presents an alternative notion of revision model based on minimal number of 
changes. 

Definition 7 

Given a database instance r, an instance r' is a Dalai repair of r wrt to IC iff 
r' ^ IC and \A{r,r')\ is a minimal element of {|A(r, r*)| | r* ^ IC}. □ 

We could give a definition of Dalai consistent answer exactly in the terms of 
definition |l|, but replacing "repair" by "Dalai repair" . 

It is possible to specify Dalai repairs using the same repair programs we had in 
section 1^, bu t with the persistence defaults replaced by weak constraints ( Buccafurri 



et ai, 2000| ) . The latter will not be a sort of weak version of the original, database 



ICs. Rather they will be new constraints imposed on the answer sets of the repair 
program, actually on nA(7'), the part of the repair program of section ^ that is 
responsible for the changes. 



As described in (Buccafurri et ai, 200C), weak constraints are written in the form 



<= Li, . . . , Ln, where the L^'s are literals containing strong or weak negation. They 
are added to an extended disjunctive program. Their semantics is such, that, when 
violated in a model of the program, they do not necessarily "kill" the model. The 
models of the program that minimize the number of violated ground instantiations 
of the given weak constraints are kept. 

In order to capture the Dalai repairs we need a very simple form of weak con- 
straint. The program 11^ (r) that specifies the Dalai repairs of a database instance 



r wrt a set of BICs consists of program II Air) of section 5A (rules 1. - 3.) plus 
4" . For every database predicate p, the weak constraints 

<= p'{x), notp{X), (4) 
<= V(S), P{X). 

These constraints say that the contents of the original database and of each repair 
are expected to coincide. Since they are weak constraints, they allow violations, but 
only a minimum number of tuples that belong to the repair and not to the original 
instance, or the other way around, will be accepted. 
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The results for the change program IlAir) still hold here. The program obtained 
by the combination of the change program with the weak constraints 4" . in (^) will 
have answers sets that correspond to repairs that are minimal under set inclusion 
and under number of changes, i.e. Dalai repairs only. So, for BICs and finite domain 
databases we have 

Theorem 3 

Given a (finite domain) database instance r and a set of BICs IC : 

1. For every Dalai repair r' of r wrt IC , there exists an answer set S of 11^ (r) 
such that I{S) = r' . 

2. For every answer set S of n^(r), there exists a Dalai repair r' of r wrt IC 
such that I{S) = r'. □ 

As with Winslett's repairs, the theorem still holds for infinite domain databases 
when the BICs are domain independent. 

Example 10 

Let D = {a}, r = {p{a)} and IC = {^p{x)y q{x),^q{x)y r{x)}. In this case, n^(r) 
is 



dom{a) <— 




p{a) ^ 




^p'{X)\/q'{X) ^ 


- p{X), not q{X) 


q'iX) ^ 


- P{X) 




- -q'{X) 


W{X)Vr'{X) ^ 


- q{X), not r{X) 


r\X) ^ 


q{x) 




- -r'{X) 




= p'{X), not p{X) 




. -.p'{X),p{X) 




q'{X), not q{X) 




. W{X),q{X) 


4 


r'{X), not r{X) 



^ ^r'{X),r{X). 

Weak constraints arc implemented in DLVQ Running DLV on this program we 
obtain the answer set {dom{a),p{a), -ip'(a)}, corresponding to the empty database 
repair, but not the other Winslett's repair {p{a),q{a),r{a)}, whose set of changes 
wrt r has two elements, whereas the first repair differs from r by one change only. □ 



They are and are specified by :~ Cnni., where Cnni is a rnniiinctinn nf (possibly negated) 
literals. See DLVs user manual in bttp://www.dbai.tuwicn.ac.at/proj/dlv/man 
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Notice that, by construction of n^(r), in most cases the primed predicates in 
the answer sets of the program will not contain all the information (we replaced 
the persistence defaults 4. by the weaks constraints 4".). In consequence, we will 
have to interpret the result, and the answers to queries will be obtained by using 
negation as failure, as we shown in the following table: 



original query 



p{x) 



query in the program 



query(X) ^ p'(X). 
query (X) ^ p(X), not 



query(X) 



query (X) 
- dom(X), 



- -p'(x). 

not p(X) 



not p'(X) 



10 Extensions 

In this section we will show how the specifications of database repairs given for 
binary integrity constraints can be extended to referential integrity constraints and 
to universal constrains with more than two database literals in the standard format. 
We will only consider the case of minimal repairs under set inclusion. 



10.1 Referential integrity constraints 

By appropriate representation of existential quantifiers as program rules it is pos- 
sible to apply the methodology for universal constraints presented in the previous 
sections to handle referential integrity constraints (RICs). 

Consider the RIC: Vx {P{x) 3y R{x,y)), and the inconsistent database in- 
stance r — {P{a), P(b), R{b,a)}. For things to work properly, it is necessary to 
assume that there is an underlying database domain D. The repair program has 
the persistence default rules 

P'{X) <- P{X)- -^P'{X) ^ not P{X); 

R'{X, Y) ^ R{X, Y): -^R'{X, Y) <- not R{X, Y). 
In addition, it has the stabilizing exceptions 

-^P'{X) ^ not aux'{X),^R'{X, null), (5) 
R'{X, null) ^ P'iX), not aux'{X); (6) 

with 

aux'iX) ^ R'{X,Y); 

and the triggering exception 

-^P'iX) V R'{X, null) ^ P{X), not aux{X), (7) 

with auxiX) R{XS)- 

The variables in this program range over D, that is, they do not take the value 
null. This is the reason for the last literal in clause (||). The last literal in clause (||) 
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is necessary to insert a null value only when it is needed; this clause relies on the 
fact that variables range over D only. Instantiating variables on D only^ the only 
two answer sets are the expected ones, namely delete P{a) or insert R{a, null). 

It would be natural to include here the functional dependency X Y on R, 
expressing that X is a primary key in R and a foreign key in P. This can be done 
without problems, actually the two constraints would not interact, that is, reparing 
one of them will not cause violations of the other one. 

Finally, it should be clear how to modify the specification above if the only 
admissible changes are elimination of tuples, but not introduction of null values. 
For example, the triggering exception (Q) would have to be changed into ^P'{X) ^ 
P(X), not aux{X). 



10.2 Referential ICs and strong constraints 



It has been possible to use DLV to impose some preferences on the repairs via an 
appropriate representation of constraints, obtaining, for example for RICs, intro- 
duction of null values, a cascade poHcy, ... 

Example 11 

(example^ cont'd) Consider the same schema and FDs, as before, but now extended 
with a unary table Person[Name) . Now, we have the following instance 



Emp 



Name 



SSN 



Irwin Koper 677-223-112 
Irwin Koper 952-223-564 
Michael Baneman 952-223-564 



Person 



Name 
Irwin Koper 
Michael Baneman 



The DLV repair program, without considering any change on table Person, is as 
in example ^ but with: 

dom_number("677-223-112") . dom_nuiiiber( "952-223-564") . 

% initial database 

emp("Irwin Koper", "677-223-112"). emp("Irwin Koper", 
"952-223-564"). emp("Michael Baneman", "952-223-564"). 

If DLV is run with this program as input, we obtain the answer sets: 

{ emp _p("Irwin Koper", "677-223-112"), 

-emp_p("Irwin Koper" , "952-223-564") , 

emp_p( "Michael Baneman" , "952-223-564") , 
-emp_p ( "Michael Baneman" , "677-223-1 12 " ) } 



A simple way to enforce this at the object level is to introduce the predicate D in the clauses, 
to force variables to take values in D only, excluding the null value. 
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{ ... ,-emp_p(" Irwin Koper" , "677-223-112") , 
emp_p("Irwin Koper" , "952-223-564") , 
-emp_p( "Michael Baneman" , "952-223-564") , 
-emp_p( "Michael Baneman" , "677-223-112")} 

corresponding to the database repairs: 



Emp 



Name 



SSN 



Irwin Koper 



677-223-112 



Michael Baneman 952-223-564 



Emp 



Name SSN 
Irwin Koper 952-223-564 



In the second repair Michael Baneman does not have a SSN, in consequence 
it is not a consistent answer that he has a SSN. Actually, it is possible to ask 
with DLV for those persons who have a SSN by computing the answer sets of the 
program extended by the query rule: query (X) :- emp_p(X,Y) . Two answer sets 
are obtained: 

{ query("Irwin Koper"), query("Michael Baneman")}, -[ 

query ("Irwin Koper")} 

From them, we can say that only Irwin Koper has a SSN (in all repairs). If we 
want every person to have a SSN, then we may enforce the RIC, V x{Person[x) 
3 yEmp{x, y)), stating that every person must have a SSN. 



In section 10.1, we repaired the database introducing the RIC as a part of the 
program, producing either the introduction of null values or cascading deletions. 
We may not want any of these options (we do not want null values in the key 
SSN) or we do not want to delete any employees (in this case, M. Baneman from 
Person). An alternative is to use DLV^s possibility of specifying strong constraints, 
that have the effect of pruning those answer sets that do not satisfy them. This can 
be done in DLV hy introducing the denial :- dom_najiie (X) , not has_ssn(X)., 
with has_ssn(X) :- emp_p(X,Y) .. The answer sets of the original program that 
do not satisfy the ICs are filtered out. 

Now, only one repair is obtained: 

{ emp_p("Irwin Koper" , "677-223-112") , 

-emp_p("Irwin Koper" , "952-223-564") , 

emp_p( "Michael Baneman" , "952-223-564") , 
-emp_p( "Michael Baneman" , "677-223-112") , 

has_ssn("Irwin Koper"), has_ssn( "Michael Baneman"), 

query("Irwin Koper"), query ("Michael Baneman")} 



In it, every person has a SSN (according to the has_ssa predicate). As expected, 
the answers to the original query are X=" Irwin Koper" and X="Michael Baneman". 
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10.3 Extensions to other universal ICs 

In order to handle universal ICs with a larger number of database literals, we can 
use the same program n(r), but with nA(?'), as introduced in definition|| for BICs, 
now without the condition ri + m < 2 in (Q). Now m and n can be arbitrary. 
This will produce properly disjunctive stabilizing rules, by passing in turns just 
one of the disjuncts to the body in it complementary form. Furthermore, we need 
to extend Ti^{r) with more disjunctive stabilizing rules. In essence, as indicated 



in ( Arenas et al., 2000a ), we need to consider all possible subsets of the database 
literals appearing in the standard format (|l|) and put them in a disjunction in the 
head, passing to the body the remaining literals and the formula (p. We will show 
this by means of some examples. 

Example 12 

Consider the DB instance r = {P(a), (5(a), R{a)} and the following set of ternary 
integrity constraints IC = {^P{x)y ^Q{x)y R{x),^P{x)y ^Q{x)y ^R{x),^P{x)y 
Q{x)V^R{x), P{x)\/^Q{x)y^R{x),^P{x)yQ{x)yR{x), P{x)y^Q{x)yR{x),P{x)\/ 
Q{x) V -^R{x)}. The repair program contains the usual persistence defaults for 
P, Q, R, plus triggering exceptions, e.g. for the first IC in IC: 

^P' (x) \/ ^Q' (x) V R' (x) ^ P{x),Q{x),not R{x), 

and the stabilizing rules directly obtained from definition ^, e.g. for the first IC 

-^P'{x)y ^Q'{x) ^ -^R'ix), (8) 
-^P' (x) V R' (x) ^ Q'{x), 
^Q'{x)\/ R'{x) ^ P'{x). 

We add to the program the other possible combinations, e.g. for the first IC: 

^P'{x) ^ Q'{x),^R'{x), (9) 

R'{x) ^ P'(x),Q'(x), 
^Q'ix) ^ P'ix),^R'ix). 

In this case we obtain as answer set the only repair, namely the empty instance, 
represented by {P(a), Q(a), P(a), -iP'(a), ^Q'(a), ^P'(a)}. It is easy to verify that 
without using the disjunctive stabilizing rules (|^), but with the rules (^) as the only 
stabilizing rules, the empty repair cannot be obtained. □ 

Example 13 

Let D — {a, 5, c}, r — {p(a, b),p{b, c)} and IC the transitivity constraint -^p{x, y) V 
^p(y, z) W p(x, z). Here, the only repairs are ri ~ {p(a, 6)}, r2 = {p{b, c)} and ~ 
{p(a, 6),p(6, c),p(a, c)}. The repair program n(r) contains the facts dom{a), dom{b), 
dom(c),p{a,b),p{b,c) plus the rules 

p'{X,Y) ^ p{X,Y),not^p'iX,Y) 
-^p'{X,Y) ^ dom {X ) , dom{Y) ,not p{X,Y),not p'{X,Y) 
^p'{X,Y)\/^p'iY,Z)\/p'{X,Z) ^ p{X,Y),piY,Z),notp{X,Z) 
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-^p'iY,Z)\J p'{X,Z) ^ dom{Z),p'{X,Y) (10) 

-^p'{X,Y)\J p'{X,Z) ^ dom{X),p'{Y,Z) 

^p'{X,Y)W^p'{Y,Z) ^ dom{Y),^p'{X,Z) 

-^p'{Y,Z) ^ dom{Z),p'{X,Y),^p'{X,Z) 

p'{X,Z) ^ p\X,Y),p'iY,Z) 

MX,Y) ^ dom{X),p'iY,Z),^p'{X,Z). 

With this program we will get as answer sets the three repairs, but also six other 
models corresponding to non-minimal repairs, e.g. {dom(a), dom{b), dom{c), 
p{a,b), pib,c), p'{a,b), p'ib.c), p'{a,c), p'{b,b), p'{c,b), p'(c,c), p'{a,a), p'{b,a), 
p'(c, a)}, meaning that we are repairing the database by inserting the tuple (a, c) 
into p, but also the tuples (&, 6),(c, 6), etc. The reason is that a rule like (^0|) 
for example is inserting tuples {x,z), for essentially any z, independently of the 
condition in the body. In order to solve this problem, one can add extra con- 
ditions in the body of (^0|) that relate the possible values for z with the val- 
ues in the original database. In consequence, that rule should be replaced by 
^p'{Y,Z) V p'{X,Z) <- p{Y,Z),not p{X,Z),p'{X,Y). The domain predicate, in- 
troduced in ( p^ ) to make the rule safe, is no longer needed. Similar changes have 
to be performed in the other stabilizing rules. □ 



11 Conclusions 

There are several interesting open issues related to computational implementation 
of the methodology we have presented. 

The existing implementations of stable models semantics are based on grounding 
the rules, what, in database applications, may lead to huge ground programs. In 
addition, those implementations are geared to computing stable models, possibly 
not all of them, and answering ground queries. At the same time, in database 
applications the possibility of posing and answering open queries (with variables) 
is much more natural. In addition, consistent query answering requires, at least 
implicitly, having all stable models. 

It would be useful to implement a consistent query answering system based on the 
interaction of our repairs logic programs with relational DBMS. For this purpose. 



some functionalities and front-ends included in DLVs architecture ( Eiter et 
^000| ) could be used. 



Another interesting issue has to do with the possibility of having the consistent 
query answering mechanism guided by the query, so that irrelevant computations 
are avoided. 

There, are other open problems that could be considered: (a) Analyzing condi- 
tions under which simpler programs can be obtained, (b) A more detailed treatment 
of referential ICs (and other existential ICs). (c) Identification of other classes of 
ICs for which the well-founded interpretation and the intersection of all database 
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repairs coincide, (d) Preferences for certain kinds of repair actions. In principle they 
could be captured by choosing the right disjuncts in the triggering rules. 



With respect to related work, the closest approach to ours is presented in (Greco 



et at, 2001) (see also (Greco and Zumpano, 2000: Greco and Zumpano, 2001)) 



There disjunctive programs are used to specify the sets of changes under set in- 



clusion that lead to database repairs in the sense of (Arenas et at, 199£). They 
present a compact schema for generating repair programs for universal integrity 
constraints. The application of such a schema leads to programs that involve essen- 
tially all possible disjunctions of database literals in the heads. They concentrate 
mainly on producing the set of changes, rather than the repaired databases explic- 
itly. In particular, they do no have persistence rules in the program. In consequence, 
the program cannot be used directly to obtain consistent answers. They also intro- 
duce "repair constraints" to specify preferences for certain kinds of repairs. 

Another approach to database repairs based on logic programming semantics 



consists of the revision programs (Marek and Truszczynski, 1998). The rules in 



those programs explicitly declare how to enforce the satisfaction of an integrity 
constraint, rather than explicitly stating the ICs, e.g. 

in{a) ^ m(ai), . . . , in{ak), out{bi), . . . , out{bm) 

has the intended procedural meaning of inserting the database atom a whenever 
ai, . . . , flfc are in the database, but not bi, . . . ,bm- They also give a declarative, 
stable model semantics to revision programs. Preferences for certain kinds of re- 
pair actions can be captured by declaring the corresponding rules in program and 
omitting rules that could lead to other forms of repairs. Revision programs could 



be used, as the programs in ( Greco et ai, 2001 ), to obtain consistent answers, but 



not directly, because they give an account of the changes only. 
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Appendix: Proofs 

Proof of Proposition ^ 

Consider an arbitrary element in IC: 

n m 

y Pi{xi) V y -^qiivi) V If. 

i=l 1=1 

We have to prove that I{S) satisfies any instantiation of this formula, that is 

n m 

I{S)^y p,{a,)vy ^q,{h)Vf (11) 



i=l 



We need to consider two cases. 



(I) If r does not satisfy this ground constraint, then S satisfies the body of the 
ground triggering rule: 

n m n ni 

y Pi{a.i)vy ^q'i(bi) ^ doni{ai,... ,an), /\ not p^idi) , /\qi{h), not (p. 

i—l i—1 i—1 i—1 

Thus, there exists p-(aj) e S" or -^q'jibj) G S. But, if p'^{di) e S, then I{S) |= 
Pi{di), and therefore ([nh holds. If -^q'jibj) G S, then q'j{bj) ^ S. Thus I{S) h 



■^qj{hj), and therefore ( 



11 



holds. 



(II) If r satisfies the ground constraint, then r could satisfy ip, and in this case 
I{S) 1= Lp. Otherwise, r satisfies some Pj{dj) or some ^qj{bj). 
Assume that (11) is not true. In this case, I{S) ^ (p, and therefore r must 
satisfy some Pj{dj) or some -^qj{bj). If r satisfies pj{dj), then Pj{dj) S S. 
But, I{S) y= pj{dj), since (11) does not holds, and therefore -^p'j{dj) S S, 
by definition of I{S). But, in this case S satisfies the body of the ground 
stabilizing rule: 

J — 1 n m 

yp-{d.)^ V pK^^)'^y-qKk) - 

i=l + 1 i—1 

dom{di, . . . , bm) , -^p'j{dj) , not p. 

Thus, by using an argument analogous to the argument given in (I) , we con- 
clude that (11) holds, a contradiction. 

The case in which r satisfies ^qj(bj) can be handled in a similar way. □ 
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Proof of Proposition |j 

In order to prove that S{r,r') satisfies TlAir), we need to consider only the four 
different kinds of ground stabilizing rules (the satisfaction of the other rules follows 
from the fact that r' satisfies JC). 

If 5'(r, r') satisfies the body of the rule (7'(6) ^ p'{a), not (p, then r' must satisfy 
p{a) and -^ip. But r' |= q(J)) V -^p{a) V ip, because VxVy(g(x) V ^p[y) V (p) € /C, and 
therefore, r' ^ q{h). Thus, q'{h) G 5(r,r'). 

In the same way, it is possible to prove that S{r,r') satisfies all the rules of the 
form: 

^ p'{a), not ip, 
q'{b) ^ -^p'{a), not ip, 
~'q'{b) ^ -^p'{a), not ip. 

□ 



Proof of Proposition |^ 

From the previous proposition, we know that the change program has models. Now, 
that program can be partitioned into two programs, the first one containing the sta- 
bilizing rules and modified versions of the triggering rules, where the literals of the 
form not p in the bodies are replaced by p* . The other one contains the domain and 



database facts plus the new rules p*{X) ^ not p{X). By a result in (Lifschitz and 



Turner, 1994), the partitioned program has as answer sets the unions of the answer 
sets of the second program and the answer sets of the first one, where the atoms 
p* are treated as extensional database predicates. The second program is stratified 
and has one answer set. The first one does not contain weak negation, it is a pos- 
itive program in that sense, and its minimal models coincide with its answer sets. □ 

Proof of proposition ^ 

Notice that the two sets added to Sm on the right-hand side are expected to give 
an account of the persistence rules that are not included in nA(?'). 
Let S'J^J be the set added to Sm- 

{p'{a) I p{a) e Sm and ^p'(a) Sm} U { V(a) I p(a) ^ Sm and p'{d) Sm}- 

It is easy to verify that ^Il{r) = ^'^'IlA{r). Then, since Sm is an answer set of 
IlA{r), in order to prove that S is an answer set of n(r), it suffices to prove (I) and 
(II) below. 

(I) S',, c na(^n(r)). 

Let 1(a) be an element of S'j^j. If l{a) — p'{a), then p(a) € S]\i and ^p'{a) ^ 
Sm, and, therefore, p{a) and p'{a) -f— p{a) are rules in ■^n(r). Thus, p'{a) 
is in na{^U{r)). If l{a) = -'p'(a), then p{a) ^ Sm and p'{a) ^ Sm, and, 
therefore, -^p'{a) <— dom{a) is a reduced ground persistence rule in ■^n(r). 
Thus, V(a) is in na('^n(r)). 

(II) From S']^,j is not possible to deduce an element that is not included in S. 
Assume that q'{Y) ^ dom{Y) , p'{X), not is a rule in nA(?'), and 
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q'(b) ^ doniih) , p'{a) is a rule in ^\l[r). If p'{a) S S'^j, we need to show 
that q'(J)) G S. By contradiction, suppose that q'il)) ^ 5. Then q'ib) ^ Sm 
and q'(b) ^ 5^,^. Therefore, q(b) S'm or G S'm. If is not in S'm, 

then 5m satisfies the body of the rule 

(7'(6) V -ip'(a) ^ dom(b) , p{a) , not q{b) , not (p, 

because p'(a) G S'j^j. In consequence, p(a) G Sm- But, this implies that q'(b) G 
S'a/ , a contradiction, or -ip'(a) G S'a/ , also a contradiction (since p'(a) G S'j^). 
Otherwise, if ->q'{b) G Sm, then by using the rule ^p'(a) ^ dom{d) , -^q'{b), 
we can conclude that -ip'(a) is in 5m, a contradiction. 
Analogously, it is possible to prove the same property for any of the rules: 

-^q'iY) ^ dom{Y), p'{X), not (p, 

q'{Y) ^ dom{Y), ^p' {X) , not ip, 
-^q'{Y) ^ dom{Y), -^p'{X), not ip. □ 



Proof of Lemma ^ 

Let 5 be a answer set of nA(?') such that 5 is a subset of 5(r, r'). First, we will 
prove that A(r,/(5)) C A(r,r'). 

If p(a) G A(r, /(5)), then one of the following cases holds. 

(I) r ^ p{d) and /(5) ^ p{d). In this case, p{d) G 5 and p'{d) ^ 5. Thus, by 
definition of /(5) we conclude that ^p'{d) G 5. Therefore, ^p'{d) G 5(r, r'). 
But this implies that r' ^ p(a). Thus, p{d) G A(r, r'). 
(II) ?■ ^ p(a) and /(5) |= p{d). In this case, p(a) ^ 5 (5 is a minimal model and 
p{a) does not need to be in 5 if it was not in r). Thus, by definition of /(5) 
we conclude that p'{d) G 5. Therefore, p'{d) G 5(r, r'). But this implies that 
r' \= p{a). Thus, p{d) G A(r, r'). 

Thus, A(r, /(5)) C A(r, r'). But, by proposition]^, I{S) satisfies /C, and therefore, 
A(r, /(5)) must be equal to A(r, r'), since A(r, r') is minimal under set inclusion 
in {A(r, r*) \ r* ^ IC}. Then, we conclude that I{S) = r' . □ 

Proof of Theorem ^ 

We will prove the first part of this theorem. The second one can be proved analo- 
gously. 

Given a repair r' of r, by lemma |l|, r' — I{Sm), where Sm is an answer set 
of nA(r), with Sm ^ S{r,r'). Define 5 from 5m as in (|). We obtain that 5 
is an answer set of n(r). By construction of 5, I{S) — /(5a/). Furthermore, 
/(5) = {p{a) I p'(a) G 5}. ' □ 

Proof of Proposition 

Since it is always the case that Wn(r) = Core{n{r)) (Leone et ai, 1997), we only 
need to show that Core{Il{r)) Q Wn(r) ■ In consequence, it is necessary to check that 
whenever a literal (-i)p'(a) belongs to Core{Il{r)), where a is tuple of elements in 
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the domain D and p is a database predicate, {^)p'(a) can be fetched into VV^(.j,j(0) 
for some finite integer n. 

Each literal L in the original database r, in its primed version, will become L or 
its complement L in the answer set^. We will do the proof by cases, considering 
for a literal L : (-i)p'(a) contained in Core(n{r)) all the possible transitions from 
the original instance to the core: (a) negative to positive, (b) positive to positive, 
(c) negative to negative, (d) positive to negative. We will prove only the first two 
cases, the other two are similar. 

For each case, again several cases have to be verified according to the different 
ground program rules that could have made p'{a) get into Core{Il(r)). 

(I) Assume p'{a) G Core(n{r)). To prove: p'{a) G Wu{r}- Two cases 

1. p{a) ^ r. Since FDs can only produce deletions p'{a) has to be true because 
an unary constraint was false for p{a): (p(a) V f{a,)) G ICd is false, where 
ICd is the instantiation of the ICs in the domain D. Then, ip{a) is false. In 
the ground program we find the rule p'(a) < — dom{a) , ^ip{a) . The second 
subgoal becomes true of 0. Since domia) G Wi(^)(0). Then, p'{a) G W^^^^^. 

2. p{a) G r. Intuitively, p{a) persisted. This means there is no ground IC of the 
form p'(a) V (p{a) that is false, nor of the form -^p' (a) W ^{a), with ip(a) false. 
Otherwise, p'{a) could not be in the core. The second case implies that we can 
never obtain -ip'(a) by means of a rule of the form -^p'(a) < — dom{a), -iip{a). 
Some cases need to be examined: 

(a) There is (p(a)V(p(a)) with 1^9(0) G ICd false. Then, with the rule p'{a) < — 
dom{a), ^ip{a), with if{a). In this case, as in case 1., p'{a) G W^j^^(0). 

(b) If there is no ground constraint as in the previous item, either because 
there is no (p(a) V ip{a)) in ICd or the (p{a)s are true, then there is 
no applicable rule of the form p'{a) < — dom{a) ^ -np{a) in the ground 
program. Since rules associated to FDs delete tuples only, we could obtain 
p'ia) due to a default rule p'ia) < — domla) , p{a) , not ->p'{a) only, via the 
unfoundedness of -^p'{a), or directly via the unfoundedness of ^p'{a) in the 
ground program. If the >Vn(r) operator declares -^p'{a) unfounded, then 
p'{a) will belong to Wn(r)- So, we have to concentrate on the unfoundeness 
of -ip'(a). 

i We know that we can never get -ip'(a) from rules of the form -^p'{a) < — 
dom{a), -^ip{a). 

ii -^p'{a) cannot be obtained via the default rule, because ^p'{a) < — 
dom{a), not p{a), not p'{a) has the second subgoal false. 

iii -ip'(a) cannot be obtained via a possible unfoundedness of p'{a), be- 
cause p'{a) belongs to answer sets. 

iv We are left with rules associated to FDs. Assume that {^p{a) V -^p{b) V 

^ Actually only positive literals appear in r, but we are invoking the CWA. All the literals in the 
original instance will belong to Core{Tl{r)). 
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c = d) G ICd- There are only two alternatives: c = d, in which case, 
the associated triggering rule cannot be applied; or c ^ d and ^p{b) 
is true and there is no {p{b) V x(6)) € ICjj with x{b) false (otherwise, 
-^p'{a) would have to be true). 

The rule ->p'{a) V ^p'{b) < — dom{a),dom(b),p{a),p(b),c ^ d cannot 
be applied, because p{b) is false. 

We have to analyze the stabilizing rule ^p'{a) < — p'{b),c ^ d. If 
c = d, the rule does not apply. Otherwise, we have p{b) ^ r, and then 
-^p{b) G y^u{r)^)- P'i^) cannot be obtained from the default p'{b) < — 
dom{b),p{b), not -^p'{b), because p{b) is false. Neither can it be obtained 
from a rule p'{b) < — dom{b), -^x{b)-, because x(^) would have to be 
true. 

In consequence, p'{b) is unfounded, i.e. -^p'{b) e VVn(^)(0), then -ip'(a) 
turns out to be unfounded: p'{a) G VV^^^^(0). 

(II) -^p'{a) G Core(n(r)). The other (similar) cases are: 

1. p{a) ^ r and -ip'(a) € Core{Jl{r)). 

2. p{a) e r and -'p'(a) e C. 

It is possible to show that always Core{Jl{r)) C W^/ n(0). □ 



